Availability depends on the first exhausted resource
DoS interferes with legitimate access to a service; DDoS uses distributed attack traffic. A bottleneck may arise in networking, protocol state or an application backend. An inexpensive request that triggers a costly query can create pressure even at a modest request count.
A slowdown can also result from legitimate demand, failure or misconfiguration. Distinguishing causes requires a timeline, resource measures and request characteristics. A traffic increase alone does not establish an attack.
Further reading: Cloudflare: What is a DDoS attack?
Protect capacity while preserving legitimate use
Caching, request-cost limits, queues, rate limits and upstream protection address different bottlenecks. Per-IP limits can affect legitimate users behind a shared gateway. Adding servers does not necessarily fix upstream bandwidth exhaustion.
This unit uses arithmetic rather than generating load. Real load testing requires separate authorization, bounded traffic, monitoring and stop conditions; ordinary website-testing permission does not imply it.
Example: capacity of 100 work units per second
A synthetic service processes 100 work units per second. A normal request costs 1 and a report costs 20. Four reports plus 30 normal requests per second require 110 units.
There are only 34 requests, but their cost exceeds capacity. Caching reusable reports or limiting the costly path may preserve legitimate use better than indiscriminately blocking everything.
Conclusion: Locate work cost and the bottleneck first. The model establishes no malicious intent.
Offline exercise: calculate request cost
Use paper or a local calculator. Send no requests to a website.
- Calculate 4×20+30×1 and compare it with capacity 100.
- Reduce reports to three per second and calculate again.
- Describe one way rate limiting could affect a legitimate user.
Expected result
The original cost is 110; the adjusted cost is 90. The second is below capacity in the model, but real latency and bursts remain unmeasured.
Check your work
Why does 90 being less than 100 not guarantee a real system will never time out?
Finish and clean up
Keep the calculation and assumptions. No load test needs stopping or rollback.